Hunt List
12,910 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2024-44065 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint | |
|
80
|
CVE-2026-33608 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | An attacker can send a notify request that causes a new secondary domain to be a | |
|
80
|
CVE-2026-49106 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Const | |
|
80
|
CVE-2026-49109 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Salesforce and Contact F | |
|
80
|
CVE-2026-49763 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot < | |
|
80
|
CVE-2026-49765 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Fo | |
|
79
|
CVE-2026-47708 |
9.3 | 0.0038 | NET NO AUTH LOW CX NO UI | MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior | |
|
78
|
CVE-2026-52723 |
9.1 | 0.0038 | NET NO AUTH LOW CX NO UI | ePA 3.x Integration implements the authorization workflow and writes Medical Inf | |
|
77
|
CVE-2026-61458 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/ | |
|
76
|
CVE-2026-35274 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
76
|
CVE-2026-46485 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments u | |
|
75
|
CVE-2026-34376 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user | |
|
75
|
CVE-2025-28343 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function Thr | |
|
69
|
CVE-2026-19157 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 | |
|
69
|
CVE-2026-11708 |
9.3 | 0.0038 | NET NO AUTH LOW CX | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site script | |
|
69
|
CVE-2026-11712 |
9.3 | 0.0038 | NET NO AUTH LOW CX | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site script | |
|
69
|
CVE-2026-11707 |
9.3 | 0.0038 | NET NO AUTH LOW CX | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Applicati | |
|
69
|
CVE-2026-75843 |
9.4 | 0.0038 | NET LOW CX NO UI | ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC tra | |
|
69
|
CVE-2026-60220 |
9.3 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
69
|
CVE-2026-60632 |
9.3 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
69
|
CVE-2026-71037 |
9.3 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
68
|
CVE-2026-20267 |
9.0 | 0.0038 | NET NO AUTH NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-42661 |
8.8 | 0.0038 | NET LOW CX NO UI | Custom role Path Traversal in WP Customer Area <= 8.3.4 versions. | |
|
68
|
CVE-2026-7951 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a | |
|
68
|
CVE-2026-8524 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed | |
|
68
|
CVE-2026-8526 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a | |
|
68
|
CVE-2026-13031 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remot | |
|
68
|
CVE-2026-13033 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 1 | |
|
68
|
CVE-2026-13036 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remot | |
|
68
|
CVE-2026-13038 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 a | |
|
68
|
CVE-2026-13805 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a r | |
|
68
|
CVE-2026-13811 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
|
68
|
CVE-2026-13821 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remot | |
|
68
|
CVE-2026-13845 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
|
68
|
CVE-2026-13848 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-13888 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a r | |
|
68
|
CVE-2026-14091 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allowed a rem | |
|
68
|
CVE-2026-14107 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 allowed a r | |
|
67
|
CVE-2026-35671 |
8.7 | 0.0038 | NET LOW CX NO UI | phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability | |
|
67
|
CVE-2026-13059 |
8.6 | 0.0038 | NET LOW CX NO UI | An authenticated user with low privileges may be able to perform unauthorized re | |
|
66
|
CVE-2026-14111 |
8.1 | 0.0038 | NET NO AUTH NO UI | Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an | |
|
65
|
CVE-2026-47414 |
7.6 | 0.0038 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
64
|
CVE-2026-72780 |
7.1 | 0.0039 | NET LOW CX NO UI | Craft CMS before 5.10.5 fails to persist updated credential counters after WebAu | |
|
64
|
CVE-2026-67238 |
7.1 | 0.0039 | NET LOW CX NO UI | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, | |
|
64
|
CVE-2026-73326 |
7.2 | 0.0038 | NET LOW CX NO UI | CamaleonCMS contains a missing authorization vulnerability that allows any authe | |
|
64
|
CVE-2026-40043 |
7.1 | 0.0038 | NET LOW CX NO UI | Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUse | |
|
64
|
CVE-2026-54491 |
7.1 | 0.0038 | NET LOW CX NO UI | Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound p | |
|
64
|
CVE-2026-96644 |
7.1 | 0.0038 | NET NO AUTH LOW CX | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImage | |
|
62
|
CVE-2026-33280 |
8.6 | 0.0038 | NET LOW CX NO UI | Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may al | |
|
57
|
CVE-2026-47743 |
8.7 | 0.0038 | NET LOW CX | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defe |